https://issues.shibboleth.net/jira/browse/SSPCPP-624

[shibboleth/cpp-xmltooling.git] / xmltooling / util / ParserPool.cpp

diff --git a/xmltooling/util/ParserPool.cpp b/xmltooling/util/ParserPool.cpp
index 6a4700d..689815b 100644 (file)
--- a/xmltooling/util/ParserPool.cpp
+++ b/xmltooling/util/ParserPool.cpp
@@ -29,6 +29,7 @@
 #include "logging.h"
 #include "util/CurlURLInputStream.h"
 #include "util/NDC.h"
+#include "util/PathResolver.h"
 #include "util/ParserPool.h"
 #include "util/Threads.h"
 #include "util/XMLHelper.h"
@@ -103,7 +104,17 @@ namespace {
 
 
 ParserPool::ParserPool(bool namespaceAware, bool schemaAware)
-    : m_namespaceAware(namespaceAware), m_schemaAware(schemaAware), m_lock(Mutex::create()), m_security(new SecurityManager()) {}
+        : m_namespaceAware(namespaceAware), m_schemaAware(schemaAware), m_lock(Mutex::create()), m_security(new SecurityManager()) {
+
+    int expLimit = 0;
+    const char* env = getenv("XMLTOOLING_ENTITY_EXPANSION_LIMIT");
+    if (env) {
+        expLimit = atoi(env);
+    }
+    if (expLimit <= 0)
+        expLimit = XMLTOOLING_ENTITY_EXPANSION_LIMIT;
+    m_security->setEntityExpansionLimit(expLimit);
+}
 
 ParserPool::~ParserPool()
 {
@@ -228,17 +239,35 @@ bool ParserPool::loadSchema(const XMLCh* nsURI, const XMLCh* pathname)
         return false;
     }
 
-    Lock lock(m_lock.get());
-    m_schemaLocMap[nsURI]=pathname;
+    // Roundtrip to local code page and back to translate path as needed.
+    string topath(p.get());
+    XMLToolingConfig::getConfig().getPathResolver()->resolve(topath, PathResolver::XMLTOOLING_XML_FILE);
+    auto_ptr_XMLCh temp(topath.c_str());
+
+    Lock lock(m_lock);
+    m_schemaLocMap[nsURI] = temp.get();
     m_schemaLocations.erase();
     for_each(m_schemaLocMap.begin(), m_schemaLocMap.end(), doubleit<xstring>(m_schemaLocations,chSpace));
 
     return true;
 }
 
+bool ParserPool::loadCatalogs(const char* pathnames)
+{
+    string temp(pathnames);
+    trim(temp);
+    vector<string> catpaths;
+    split(catpaths, temp, is_any_of(PATH_SEPARATOR_STR), algorithm::token_compress_on);
+    static bool (ParserPool::* lc)(const char*) = &ParserPool::loadCatalog;
+    for_each(catpaths.begin(), catpaths.end(), boost::bind(lc, this, boost::bind(&string::c_str, _1)));
+    return !catpaths.empty();
+}
+
 bool ParserPool::loadCatalog(const char* pathname)
 {
-    auto_ptr_XMLCh temp(pathname);
+    string p(pathname);
+    XMLToolingConfig::getConfig().getPathResolver()->resolve(p, PathResolver::XMLTOOLING_XML_FILE);
+    auto_ptr_XMLCh temp(p.c_str());
     return loadCatalog(temp.get());
 }
 
@@ -287,13 +316,20 @@ bool ParserPool::loadCatalog(const XMLCh* pathname)
         }
 
         // Fetch all the <system> elements.
-        DOMNodeList* mappings=root->getElementsByTagNameNS(CATALOG_NS,system);
-        Lock lock(m_lock.get());
-        for (XMLSize_t i=0; i<mappings->getLength(); i++) {
-            root=static_cast<DOMElement*>(mappings->item(i));
-            const XMLCh* from=root->getAttributeNS(nullptr,systemId);
-            const XMLCh* to=root->getAttributeNS(nullptr,uri);
-            m_schemaLocMap[from]=to;
+        DOMNodeList* mappings = root->getElementsByTagNameNS(CATALOG_NS,system);
+        Lock lock(m_lock);
+        for (XMLSize_t i = 0; i < mappings->getLength(); i++) {
+            root = static_cast<DOMElement*>(mappings->item(i));
+            const XMLCh* from = root->getAttributeNS(nullptr,systemId);
+            const XMLCh* to = root->getAttributeNS(nullptr,uri);
+
+            // Roundtrip to local code page and back to translate path as needed.
+            auto_ptr_char temp(to);
+            string topath(temp.get());
+            XMLToolingConfig::getConfig().getPathResolver()->resolve(topath, PathResolver::XMLTOOLING_XML_FILE);
+            auto_ptr_XMLCh temp2(topath.c_str());
+
+            m_schemaLocMap[from] = temp2.get();
         }
         m_schemaLocations.erase();
         for_each(m_schemaLocMap.begin(), m_schemaLocMap.end(), doubleit<xstring>(m_schemaLocations,chSpace));
@@ -325,6 +361,7 @@ DOMInputSource* ParserPool::resolveEntity(
 #endif
     if (!systemId)
         return nullptr;
+    xstring sysId(systemId);
 
     Category& log=Category::getInstance(XMLTOOLING_LOGCAT".ParserPool");
     if (log.isDebugEnabled()) {
@@ -334,14 +371,15 @@ DOMInputSource* ParserPool::resolveEntity(
     }
 
     // Find well-known schemas in the specified location.
-    map<xstring,xstring>::const_iterator i = m_schemaLocMap.find(systemId);
+    map<xstring,xstring>::const_iterator i = m_schemaLocMap.find(sysId);
     if (i != m_schemaLocMap.end())
         return new Wrapper4InputSource(new LocalFileInputSource(baseURI, i->second.c_str()));
 
     // Check for entity as a suffix of a value in the map.
+    bool (*p_ends_with)(const xstring&, const xstring&) = ends_with;
     i = find_if(
         m_schemaLocMap.begin(), m_schemaLocMap.end(),
-        boost::bind(ends_with<const xstring&,const xstring&>, boost::bind(&map<xstring,xstring>::value_type::second, _1), systemId)
+        boost::bind(p_ends_with, boost::bind(&map<xstring,xstring>::value_type::second, _1), boost::ref(sysId))
         );
     if (i != m_schemaLocMap.end())
         return new Wrapper4InputSource(new LocalFileInputSource(baseURI, i->second.c_str()));
@@ -384,7 +422,7 @@ DOMLSParser* ParserPool::createBuilder()
 
 DOMLSParser* ParserPool::checkoutBuilder()
 {
-    Lock lock(m_lock.get());
+    Lock lock(m_lock);
     if (m_pool.empty()) {
         DOMLSParser* builder=createBuilder();
         return builder;
@@ -399,7 +437,7 @@ DOMLSParser* ParserPool::checkoutBuilder()
 void ParserPool::checkinBuilder(DOMLSParser* builder)
 {
     if (builder) {
-        Lock lock(m_lock.get());
+        Lock lock(m_lock);
         m_pool.push(builder);
     }
 }
@@ -431,7 +469,7 @@ DOMBuilder* ParserPool::createBuilder()
 
 DOMBuilder* ParserPool::checkoutBuilder()
 {
-    Lock lock(m_lock.get());
+    Lock lock(m_lock);
     if (m_pool.empty()) {
         DOMBuilder* builder=createBuilder();
         return builder;
@@ -446,7 +484,7 @@ DOMBuilder* ParserPool::checkoutBuilder()
 void ParserPool::checkinBuilder(DOMBuilder* builder)
 {
     if (builder) {
-        Lock lock(m_lock.get());
+        Lock lock(m_lock);
         m_pool.push(builder);
     }
 }